Are you an LLM? Read llms.txt for a summary of the docs, or llms-full.txt for the full context.
Skip to content

Manage OAuth Clients

OAuth clients represent applications that can authenticate users through Aero2. Each client has a client_id and client_secret used during the authorization flow.

Create a Client

curl -X POST https://aero2.dev/api/clients \
  -H "Authorization: Bearer <admin_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "My Web App",
    "redirect_uris": [
      "https://myapp.com/callback",
      "http://localhost:3000/callback"
    ]
  }'

List Clients

curl https://aero2.dev/api/clients \
  -H "Authorization: Bearer <admin_token>"

Rotate a Client Secret

If a secret is compromised, rotate it:

curl -X POST https://aero2.dev/api/clients/<id>/rotate-secret \
  -H "Authorization: Bearer <admin_token>"

The old secret is immediately invalidated. Update your application with the new secret.

Update Redirect URIs

curl -X PUT https://aero2.dev/api/clients/<id> \
  -H "Authorization: Bearer <admin_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "redirect_uris": [
      "https://myapp.com/callback",
      "https://staging.myapp.com/callback"
    ]
  }'

View and Revoke Grants

See which users have authorized a client:

# List grants
curl https://aero2.dev/api/clients/<id>/grants \
  -H "Authorization: Bearer <admin_token>"
 
# Revoke all grants (users will need to re-authorize)
curl -X DELETE https://aero2.dev/api/clients/<id>/grants \
  -H "Authorization: Bearer <admin_token>"

Delete a Client

curl -X DELETE https://aero2.dev/api/clients/<id> \
  -H "Authorization: Bearer <admin_token>"

This also revokes all associated grants.

See Also